哥斯拉流量JAVA_AES解密-日志分析

solar应急响应-日志流量分析-2

题目：新手运维小王的Geoserver遭到了攻击
小王拿到了当时被入侵时的流量，其中一个IP有访问webshell的流量，已提取部分放在了两个pcapng中了。请帮他解密该流量。
由上一题得到一个后门文件

String code="ZiFsXmEqZ3tBN2I0X1g5ektfMnY4Tl93TDVxNH0="；

解一下base得到第一题的答案f!l^a*g{A7b4_X9zK_2v8N_wL5q4}

String xc="a2550eeab0724a69"; class X extends ClassLoader{public X(ClassLoader z){super(z);}public Class Q(byte[] cb){return super.defineClass(cb, 0, cb.length);} }public byte[] x(byte[] s,boolean m){ try{javax.crypto.Cipher c=javax.crypto.Cipher.getInstance("AES");c.init(m?1:2,new javax.crypto.spec.SecretKeySpec(xc.getBytes(),"AES"));return c.doFinal(s); }catch (Exception e){return null; }}

JAVA_AES加密特征

得到了密钥

a2550eeab0724a69

流量放进wireshark进行分析

追踪HTTP流

请求头中cookie最后有个;

存在哥斯拉流量特征

用蓝队分析辅助工具箱解一下

解之前先把ascii转成hex(因为ascii存在乱码)

继续往后解

在追踪流6中得到flag

也可以用CyberChef来解

flag{sA4hP_89dFh_x09tY_lL4SI4}

日志流量-分析3

题目：新手运维小王的Geoserver遭到了攻击：
小王拿到了当时被入侵时的流量，黑客疑似通过webshell上传了文件，请看看里面是什么。

上传文件的话，我们找请求头

在追踪流6中

根据这两个返回的包发现上传了一个flag.pdf

我们把两个包之间的请求包解一下

果然有

保存一下，这里不能直接复制

可以用解密脚本，输出将结果输出到文本中

#-*- coding: utf-8 -*-
import gzip
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpadclass JAVA_AES_RAW:def __init__(self, pass_, key):self.pass_ = pass_self.key = keydef decrypt_req_payload(self, payload):""""16进制字符串: d26414f92d691674f3dedb554e70202550ff681c03dcd3572f74df4c4c68d7078abb82808610aee869f51107d7d66f60"""encrypted_text = payloadcipher = AES.new(key=self.key.encode(), mode=AES.MODE_ECB)decrypted_text = cipher.decrypt(encrypted_text)decrypted_text = unpad(decrypted_text,block_size=16)try:decrypted_text = gzip.decompress(decrypted_text)except:passreturn decrypted_textdef decrypt_res_payload(self, payload):encrypted_text = payloadcipher = AES.new(key=self.key.encode(), mode=AES.MODE_ECB)decrypted_text = cipher.decrypt(encrypted_text)decrypted_text = unpad(decrypted_text,block_size=16)return gzip.decompress(decrypted_text)if __name__ == '__main__':decrypter = JAVA_AES_RAW(pass_='pass', key='a2550eeab0724a69')java_raw_req='f7934206681c470add712c34fbb8ec29815acfbf4829272977e2a041f3a89fe058de0432fae84f3704afac9af402cb1e5bf1086bcadd9b4a923e69e03f27a0f4c2259ddd53947d5357aa6c89c80ddfa2c4b3ee4e087b8fd07179c1b301cf0a67ff2e3dea58f321d28d6bbd580483e26303eb45091f31dea53f64b61e04763938fd6e307926fb5d590e191c29fe673ff4a8be359471eef2c7baff6c99e1cf6011d4b2dbea97c368239d641c726acb59b87ec3be1ba8d8416aeaf0f48135e5863e9d0d2a3e8ba9fa0ac884c56591afa9abde4358a6345f6e39ee57d222c04750a614e345ce0677d5ad4c9ed4e0ddee5de9eb449c8a2c3c86c376b7ef4e9d2174616e7499ec0e879168c69b324924f72171c06e0b4bddf4ed9b8d23e5969b9a764377da001a53ba4feab4617bd55603211796030429e5563c0aa5f67b488ef4e960f2e7382301398d5ca1aa7360c86fbb5b1409437fe04e8939c8ac29faf54c9e6eb420745683544e13178b0d8ad24568f2da6ad88aecbffc13cdf703d82069dd84bcdc76d8ca830a363ac1e8332709a0cd765e3a5400ec43f9ff1664a66fb113a7e3898e574cad5f1dec18eb7b3d3b9fd0f60bbbf2aa98bbebe133d5b89f0698ff9ea5dbe9cb692d9736e021e86d76120fe46dfc0f5e5427cb6f7aa134a67d111e9256c331c77fbc44a37336e58db758f1cd90eec37cf1969f54848bed9f583d78c425fbd4e48028105fe0e3de5c1c6ea6e82ae6a86da86203fde867886e7ac1f4f8c0a092bf44d6509f7e41f1a9b9e46176a10ce399ec3a18f437d9904f5561df42ceb2a3b39733ec2f7fcefe02d3113ab10d9aa04518dd16f6d132e0728a7bf4bb623fb743a65924de9ec4e6c4f843186fd5f9909c4c1c6333072a5b03c36aff96fede771070252da0e40a426e652d59cea795728219931de402537d37fddc0aafdddabb83945f290fdc86e10873d328ebec0ebaa3038504f0bf35ee4b155e3e1b98a8f0018d55301f817ef68ac5e741a30d0b495c9ea6ae5b5436a56401dca7c509a419843f3d790d025b80772a3fde6d5d78197484b82c5d908b17a451e0c8ada4364b143d3081f330bfb2d19008642f59ba772747ea7bfbff548d20fb8f4091b9c1cbbaa74af71aa7f8684206303fc0d7ba8e340abc9a73b80eab9c5e74320afa123f65331465ff93702f81c1881b13e6bfbb160642e1c879471ddc2ee58d95d25fc86090f6c09fc85cc324edd589324b988eb1fe1449a4c4062a0932e743f776308e7ddd372e5cc38bf1275c641d00af25d2063c7e02300fdb4296ccdbb0ffe7607e5a869cfd402c7c2d0734232c732ba15bc0c074a208fb82176b3eb41c039a3b7d56a47f884708173c0c7f310aec28df3b9cfd0abb836a958a53c0e0bd7f88a52cbddc8d297e736926e63196b66d525f49ca5912343448ccd01eacb612edd6006cfe65bebcc7344016e20b6a08316427f6488bb909bf19b621ae8402ac7bfc2b64f1432f5ee35dbb508e8ad14f56710c409f7f15cf93131fd54d35c02607587a40e51c72fb02f79a3f179c7714383992a0de38a0e2c680079b5acedae023626480a0ba689215c627876293929c2eae12915a82aa718affa80b9dbfb27a6d998337035b88339eeb13c95f29fa5e74576291a706fbcc88eaff51238c4dd13d39e9e2c12f61fc6a9a8bf8ecf8b8af12b3f3c0ac0ef12923932fc672fe521084bfa84127d9788b23a5b4251505f4a2b4b1aeaf4a22dadd477aec23922bee0880c6a3a2f999d33a6d77d32984572c933a946a0f56053389ebbea05c585a19e9feb03fb98161b5f880c9972638e4f6413ca6c8bd237bd7d5686077d66de26854e43458c4e57126eaac537f3c238ce7a8ed8223842044dae30028669cfe3d97ba91f1bb7d46a5da8fd6e45d928e9de1b0880d2b255c9413762f7562187be576955a7b8aa6059b7c471ff61912e7cf61fa7536f7761d4d118ff33eb9fe9bf7321b804e5c18d85ef1c86fe293c984bf0502ad1afef9766b3a291f8df14c07fafdb272996410a373a0b3520c39890d8d45c5d5fefe257647bf1b040b9d5289ff3ab33849b03a785c3905193b945269fc00248233a4daff83d18fe6f8b4c8639211c59aca6d23dbc33fbcf4394e58907309ce83ac24b53d8d0b5e40005481c70a2af369b7818c14ef936e07c125213db1fcbeadee5d00979fda821475836a50fa8fd2e0e026a144a80eddb2412fb8df89c34e53e020bdcdfaca5f60692af25c9414b35b5c890b2429bb33665885ad510b246895bcc6312844843959410add44bbc369133bdb572d2b9ac276ea7a7793c3a324bcae7f1a2aaf676732e89e50a5b3c0647e129914f650d685030717b37399fdee59cfe2cbcedc10ca52fd9b73bd69567c6aa5a2aab3f417e7ef468570937fedb6db835616dc2b0aca2df76592cf35574b78d63e929fb46179f2389b5710fcb235bb1ef71a88e7619c3c8661564063b68c0b1a5d83dd0e496edd43b3d78bfc13267eb7fb6ccbd1efc9950ac3c55260ac6d0ed0a0b462e55915ca7cbd1b2a3e5c9ec41a54d7ec35daae38e6b401c734449812058a57296522ad346472f662aa0fe8ce682f4756565556c2f165e36fe537e980f94fe8a7f6f057df26a126befb93bea7c2bfaaff855dbaa4e66a26a28b8725beac2e3f8afe43b4fd0f776ccbfab4f77248ffd28c0331120767115387b993071a242a87faf8d613b6c5f4ec13a002a6e8585cd5f1ca0c4a15bc3fd6d17f54693e5a3edcddde3a7778c539c1ff75a4ed67c9b2bb38007493c3f214e6529d6529e3a8696b14f5a81e1a6dd989b0bb8e5b97ed6bb7c01f9469db9a585f07dd32d64683c357c6b70456ac6bef1d538046cdffb3a844da1e58506008c96ed4825f89d7ca322c3c0c52dab9396dd66628609ed6584fa577c2e42b49f453b5c8de6bdb0e5a2fc7e06528e53e1c502591aaa66e4a1604d75400428260bd43aca89260199298f29f3ccea04776abbebb0f306aaf4d0468c2b8b9fec57d83d9d39eda541f796a66443ae46c686a5a1702ddb81f9b3c5ae8df35d47ecd496d4f28be64ac4466f82d9af16cc1f9cfb66d3af5d8758ebd7b8b4c7f83ef5cd681ba8b37b07a11247b9505d05c47d6da41e628a0ee1bba36b861ad60ed754e9211939cadbf55458bab086d1c10afea1b7043933cf64d353128ff3e7e587f9bc89f0a12e9e888a34118a657dbdfc5a1c906e27dc18e87a79b132b4c026cfcbc77b0f0c6672bb44da0f3e264a05079153194638e4e7a862204ff65421e1c9ccc071460021bb82703196d53e794ca017a71f574d9090f1d5aafb8358d94aee4ea6223f3f751f48c1208052d29a0a769a7baa0bb0b97ae40373b5e3ac82e6233b8333a936373556dc91ab122fa3c8e8686aa1061c5c327f5cfca066a1cb741e0d067180196e430ea31e679bb70f047ddcb5883b15bba73457eb3a76184d9842bca6fc5126af53d7cbc1cf533fa55f3ee015d8d0db14bdf2f827b8d42bb393e9ffb2aece5adcbe53ccc54c27b4a7823435b9f8882241b33ab506656b4333f50f57ecff511c5a04031b19e7c70af803fd3aae773ee35814d0979cc36422cc9d2560e2c1131a61e4594d763bf4574da8054edf4c7273cf718e7d29d9f26af9aa5ac0abb77d8dff60fbac1146a2ff6324654f0476a178c43b101f129879d36c89ddef1e2c3ad78b394ad5673ae1353c137a14e15262288751d0d5f97b36816e24a81afa924ed4b1347eb317491d0453f7ea47b138f5f8240c1b6aca891d354c4e399a5a0eac97c07454c7ad7d3bdd97c45f9788b648ec1acfac8d2951461035c7817cf5ec53d91dd246afc60c658c66e4bacd3676288ca6d2211faad8a51cf3b44e82a3abdba7a87064e70e6a03f861e1f8ecbb38eb1027692e24c9698397eaae802dff9065d61f8b09d2eaec5a85db0451ffb16fcae7c07043202cdcd7655aa65df1ff3e09ca997b660a12b071344c0cbf5606c2e3767827a25e6fdcb142d88577cb3a17b88273a99a2d161fd5810ffd8e9d899f185adf227d8ef9fae57fd5ef3ebb7f744aefb9f9bd867edbe270f83eb983174d8757632d5df20f61b9484794f2136b76b8bc97bd88c391af64ce494b0115a97a78037b358ecb72ca06ac2727baef59dec59af8a92abcadca8476ecae24765f5cbe6b3646864132b1779346f0708e09eb7948a5527e24d3b3caa7913f59ccfce83c3cdfca552653b5c7dfe612f6b29157b3f154a36031aa8b3f567bc28c8467bbd92f719d153b290a8a4a181fccf6e7ce00970ca472e452db626be3d1d4737c7e25a85e1b93d6d6179ca40293369061cf39364a80496ca6296befc50577ddacaa689e22e61ffd4f284aec5e779d165584f536d5957918ebc34903935b5b12c9bb7b38e4484aa03a03e91fadd5ce58738e66f93a0f1e6a86bf7c8c404f58091934664610cd95aaa23fe8f863d64ff47d24ff0cb93b8aa44fe7b069d15df943d8d7d8db31b9dac5ef3d9eb92851c1a37d1ee4288b1bceb2763e66eb231771466af0759a32728b90d9147be0ece5823070ac432855ba124aa5374fd991ef7b416d67d3b9568ae7b1804148d67a89269766ab32b8c3879b07ec7cdadb983d5bc1a9336d638709f54172b135349fcacd03204a1994efcb581e2665f05cd4c513253c852a45e55f1dcf531a98e75327827c51f1aecd6235d375dfd801b7d046468d0f169ed9a33cf941458559ab13cc0431178f822df64531447857e8bb3092e10e33de78c25d8699e504aa8d3c565eee29088a6fba0fd8784b9601699e074dcdc67798a804898a0f76014f19e9198b5f958b8a18ab41382d3f8485110644e05a87b720ab344637bf05efc7e695bc3e658928efde9654989ab3aec9be1f906720fe237ca951c6d6ae6f220ac7d5bfbf2000d987369fd2571eeb84395e5c9a3fe1a587d004822fa5920dc6a75e8c651bf7a3c4d1ebcf7ca4c39efb3925a13a855ffcfb00da8c6cf80a8676e1124e21089ac6839dd940cd327dda6fe417c4cbd3f2be7cc658644b5ce13ed837cd0d9af91df7dc359f52878e795cba19b1a4eafc1feabddb1493fce48885f4ecf653f603cb02a102d8bd7cc527337b5fa84245c1fb940068ae78663d8f8e3400b4322481fdd02be46473cee66130d08dc9a9ce09bfef7434634dd6f67869bfd007ecbad9f8b2c5e47b31aefcdd6b2e5bbda6f7276ed4486db42ef3f6243f48adcfb71675ace51e09058bafff430424a60914faca575e2846c1d8b538a0839382381274e5de46eabc19806e8183c90240514105415a9588e4a0a3573a388e7c6931143ca65c85751a6f4cf9a043bec79cf11af05b0f490fc99e732f709dba5009ae08d1a0867d893c70047b6a08a21d661755cdd1c1d3acb0336eb8e3369900b7c0a2b13d3c40a10a6710ad5c640e3aefd29fc9c5be97c59c7ba19c32152e9db3c625e380252c639a12d352992298d5b223b813f92b570ef98207f5802408a81c7d4710364b6bd73ddd418a7689ac9dade03032078e42dffe4e7cb50a2584b9cee1b2548add677008a25140e93df868e6fd3e51af38da2cef0da88b7630810f525060a61df249b0ab7c3001e0d88b171c638f3f7981932e690e1110926a9d7839e69ddb0d1a29261716af1c563a131eb7d93a9c280abf31714b022f16fc57c1df95ace6a2ad0ae5a5fa44a9a89586fc0acfad8c5f9421d83974a25151cfa2e206ae5000f5351e430a45d0c4a5a149fd98e4cf369d1eb51a118d99a8430b31c5ac3a1eb99f5f86600ce90ce7288956cdd8e47ab98b6df570931e12a130331b6529ae0c449c9d5f11f51755f765175654528674287983d2457e0d15c8dd7ec845698de7231462f92b128d3b0fa73ff14f71a0d0d8e8eb5cd136ddb8ca4be9f44273f0ff50ea43346baeec8093ee9c08607d6e20c1d7ccd1cc8a376c65db9168fd6143a71c8c7307686653933cff2fb98b1dc79394b4794a1ca5736badae32bef43eef423e065bcfb0a52a35bde87448d15354a679822f4f67d7398b7e8d4befda2798acadd7afe6b7f23e212dde7723474cdc327ebb3ae37fae54482ca9892559ec281637caebdf54ab6074f1b91a7cbad781a8aea801f147852dcd26c291f231a45c16cb48e922cfbbdf7e50ae0338db73b4d125062caa405636a384c9aeae7df237891586f26e2a513e8dcf9cea720338d29d444f9f6bb263657d8c0973f7806af835d884b774cffdd563ab604e783edcced49b4ac02e9f570b280077e49f81b7f87573e81fc4548407a388764311232ed7d173df39a5d1180c9e90227f9fc7226255ade40aa23b858d0ca8c8c4553d744c1a8dab6c5390999921d98a9e7c27ec77f7af7c0318d6dd4c5c359dbfe5ce28cfd832e221e723058f74c2a7bd006455e991beb57216e20116c7a45bfc3e95f2f9f7b75cc3447ac3b5c5f9544354afea7bcf03a823f1ae22e86e82c17bd31239e86cb8079c662a2a44184197f6d420e2f745e3355f59bd613c42b1f55da731c3c5ebcbcca035401ee18ae86d767db385d92363ebc930ce9f7ce81fbffceddbee2a2cd28cbec6ae5222903696502e18b97c526378ba7b9bc287ee1ca87c408f44166664b12169113c03c4d9a4782fd8bc32c774578d421af646ff0a0cf68b3f15881fa01c009bd9018edde4ea0bec6b186ba02ea9cfb39c43b7fdee42d02663b3fca50f3a76f90dc9d4c10504bb651547be40f0b0a9f7abcb358d261a2145da387c78c0ac6b72c208308b15fd505fb630a45b0b5bced2ffd0ab74e11242e42982659fcda10e6ee9dd86a7dff9f4a49ba93938a40fcc2c156491c48edd6fb8c70d4048e415c755cf8eafe2c8660f4171082772194e72fc37095357f9d072f4a85e7e5627eaafe37969e8c9a0950a0c7fe3adba14405acc46c1f02826305e630b53725e43def139fa63b6d70df09fbcb010c3a75da9f54470b841820b34b785c6e7cad76751e6179822e40f235fc5091559d1c36f2fc828945f1923701858f4e5d5e7b505398a6af3b6f65640d963f2f45eb3c1b69eb0a0f4ffae8cd798354263de76d06f64633b64bcfa1269ed4a7f2d6219017de054e67dfc536bfd1e2c2dd6d21c587473d217b6d48472ee19cee92161b14cc505256da350c2bb33710623315889f4b7ecb6cf00404d1e71402e37121ae3036eba89c409752fd46bab5781eec2a91e7efba6f0b6ba11063fd1e622c16d22e41b6a4c04d10645487e9a63340d345743da8927deb3548b877a65ea3ab9e21ee9368bd257234e44f3fa33173a889e9537f10484e050e74bedfc7495aa2ed3687540a39a07345e2173e1cdc950ea34945b65eb4578b5a427bb31509aa2b9b8d026337cb44966c9893f85c8010cb9a317d5e52c9737c05a10339d79c9af73c9d93e696530af6d026a6ba935fef46bdd8f44751f62a8b4e0c89463f7de16460bb95a5db9a683d722dc412336f83fc6ca2cee7a44565ca5fb8f37b8e7d29a734ffc159298eb20595a9dc5aaeec519b8305a3713540c0a3c2a0a4f0ab89ee2ee79fcd0085f3d43d279d20b49efe01d5eedb19aebeba9ca100c687156ab112c82d1e44cb4c477564fdea6022d234b7f73e73c2c4421e15125e80d656d18e987072f7c12664dd2f4c7e494d434d0465c6d66cfc5785c89d54e480b1cb0a33051cee97c0acd8e75dc1d3500c34373bafe307b7b667828f37dee96804b9a0eafd5a43d121ba9cef4f7a10630581c63d0b75922feef458f27307452c98599d7a4186334f5473986cf8b4c00e8f69861612b06caa237bae621559b52cbf6d1c03e2748de92f1d554d4d8353014effc6241b6a88a8462c04df6d07e5b7df0b7824e763de1fec4b6025302f5ef1e40340ed4512871ae0718653efa6581211bd80348ec9b97be582dbb5de53e99e622c962aed5f2d103fb7cae3c58636b7fff6ffa6d4f342baa45d83a21d4313ae0812411207638552f3dbd3d647149a7471b6f3aa2d10b05c658ee845d421fdfa0bc6db75189869d5f95dcb28b10aeead6c47f6ffec138ea25b396d1eb391f8cda79e624b9c4489db547959cffd82a68f79860bd41a5058adc586f185ff0b43ae40d4db4f32137f1d6300469060cf47ff9d67d4fce267455230558feabe3c6ae68f9e2729534f9d840a76253e78158e746c7e524786c6e01b46c226c62bf0f120cd28d36d442729bdc41f7b47ed317c3be3a290164a5d72f5669495c5ba7e0e9bfd18405f4025a603b8fc3f199b0d6f38eae59e10ea2ea19ec100165352eaaae8c76261c7a06e1084dfa4788be689dd09579981395dd3e2d21528e97c2d5e58528ad0d7e254c58a97750f0b671fc362aaf6f038ac4735b3988f5c71a8790e32f16c8c924af5134ac8f995f0c29748874756e7878f5df0d0c79dc1964fb0a67b912fc46730ce617e2c18fe2357ad9e1bc82462527d5ccea32352f168b1f2a0456b3ff7d8033bdbc4e19758cee3ab73649655401e9d0a75fe4154d285a7c5546a5ef11fc36448bd85258ac02067af3a65714073384742baa09a3524f5145a1f13e16f26e18d202572217c5ae7f3a108e38d0265d587b11b4da8df0fab72b841776ac441244d0a19a9b43680aa6eb36c81bab3e22160f9c6c2da31417cb18478ed7feebb80e3bfed624ed4a12407a3e23883545a02e672f57229bb9df7523dcd2d31efd3a9dcccba321399adca52d33771c86c42f17b31e8aca9017aa8a9afc81f7e60d585790f07b97ae7c3f6debf467328aaf2de8c7e8d6cca15e5679577fceaffd6a56ad843095522cf37a0f22e095b4eeb9e9ea6a2e2748378c8d7ee2b494d9d9443e18708182debd400e1bb8956084acd948345ddedf3fe59d77ce5b4e10c752ce2a618755f0e12250d8dc526a4707323dfa9468b4f48805ebf744d53f4992ee1ca0c65f45a702cfc0cf275d1ea69b5187b8233ff6a0e508f1a20346853ce5b9f9d6905231e0569720cf477b15b6cc4e97251805396aed51c985601b5ddd9c21a6ff19c271ed8e76d288158f7f72476187f6aae70a83408bff05c7b19accd6a8a8bac738aebda9e690757555c1dc8cc9d9353adf0932df011896d62be32e28033295c26897e3e3e4a2f07cd335af73d9d3ed6498c143b5107ce7efb18676ad54463a73f26224663476668155cdfb4979e05ed72b40f41d18ff010fec54e7bc5057c7e4f6ae70002f8b5c4780a01523f63192037ca8bbd84130f97149c4e07cc9d04734776078f621fb129b25c28c5be1441b2c028f807a0356c3b5ec777d50f72be1521645de900566eb4e41ce8503c863c4af683ce45670830c94b5a0120cf6fe3b5757f49ff4c411a5953dfec5e46d757a22788a546d2b875ad541b4fa78d5c3f418514daaac1f6a53269b13216664513926235309929d23b2574a0a2407bbcdd20731060be3276f03b3afe2faa7538a5fbde36e11689e063416e6f003d85be9327ddcc8e43eb1d79053cd3d09c2fae5314ac356496b3d77c01b05866b453f67acac1bdc2087c331bca86ba862a142ecb3755770da95d11de2d11d9ff4889c30e27233523bbc44e95fe7aef9cc01d0d96f2f4c6868d8042413ad1c19d717baacf3b3ff33921eff23b1af2a79736627e561284fb60a8ca8275a35dd0f64c29c6552a7a29de8ffcb765b7d50fafdd2ef4176a06a4f09185c98e684f2b7da561960e80ee24624e321faa88d7d2945253f8ae870b3192bc819ea5738f845abdcaecb1768b74eaf55d3ac2883d8627dd3c13d82709c01c68a1f54126a9eabee5bf89c505622c90287ec1206f96a35bf6c518ffa79689ef5c8290ec7faf82ece498d3eb7fd6563cf75bec865df453df6866a059ba3d786a9fc34a72e3cbd09ff13802655fbbda205794ae8b9f5eaf6db9417c31e643dc46dcd93fdf5728be2a85b6ae16f640fccf955785d8cd81d1bd2a1d7adcb7104660972c3a91899273b1323a6c6d78ab3c76ba033f6eeaacd2a7a0c41fff8d0c3907b0148eedae9c00b59dcc6e26c2fc988d4361b19880feedda1149665203cfa54d9ad18923e53a53cdc72dac552e2dc69534d4b8a893ff1fa9d84663593dc4da51398dc3ebd71de6339103e76f9baefad3bd8c04bbb6faf6b536fb62b2f4e4678fb0d98feb5bb68d4feef9d7602f96fb234800244cd2389ca23c70c4cc7c0da83167c6f61014c4d91acaccbf8d239e0ccf79621cb5ba124d92cb6430924817d3f181fde8eb8c15d0f77cafbd14332ff3eb700b2663ef03c2f79006561feae580543324f8e6dc2374150c685772f30a778c404af62b35efc0e99858ae256c766143d29060079ef22ed4ca109b24338f4a4d9140aff2a0a070fb1bffdeaed9c95c0c32398f806e3042d0b134bc00081a2d514fa08b2e3214e6e7c4222346de74b32b120bd405d5bdb9f17964676a0840f971a5b1f8e79a3e6ca0254399b970660f6d240946616cd9118746b024e09e75c3bc622f0a79abbcd9d5894237cff62c2b7b291d837c6dc4c7206183c00d79932b3abfdd1b3b480bd3a471f902621e701ec339e262c2e459d1c574b8b232a3649c4b34251ba42d556a3ccc01e2a51a725c78c1c18a95e2056915315b0177c0a96d07ec05f9831691d3504e34e9592d1166df4022df0413f8a679029fdb8f7e8a74aa0f376716c9ca1aabaad88aa9bb0f8c9647876712b111e3464c971337c11692245273514aa4878463735edd1e790ea3a3118de4c0f5e95106e727d4ada09b13b2e120ad84fdf4702fc22766c22b6cef3602023f5524a26892024ae308cb25500de5ddab0a9b2d25de1a58b5a1455989a37a1f89c049d131c1559398d36578c45ad616428a7eacef87a34bf00fac8c7ca848afd7d9b7c35d6748f1614f8409dce51764d81b1a2237b52e5f99b90001422f0fac61a7ff9b9b59ea1c95953206b37ce6ddca667eb9eba4d1e58666e8bb18e04b67ee905b191f9e8d4cf01c5f3b96a074e2535da2c6a6c8a42319e9622a6d901f873fe3355129a25f8aa8efda59dbc9f7b23585aa93e50390bced21f09481a8474d93c7874c33277d4d363fcbba0a1664089f2f571a4763d44c3d62e0742fbea451c5a4a41d313ae052c85a4349b74e34c2c9b579bd1093a3f5be573f3fa825760d7c13d620697a6a57f7292a7d2f6f734401c5d8e9184a66b2bd259b7723686abcd7d549a6b6a8c2cdcc62180c99645307947c03e7376e9256eb3ff9b16a1fcaca38dbbc840a33c197d0acd4316d9c3964b9706c683d403b8ffd74983e208c1b1bbb61c70ef28727975c8fc019aeb175ea495cce7fc22e6a0d9d6898b0cb82291cd0c21c4f2b058601ff4c2d757f819295fe12708f9af64c62ab7c304e37c602c4044fbf17aad7d3aa35c65278f2155c2f75dda5e6114625218b2468eb6b630eb9e409b85d9a7baf789ba14db738497190e67e0a164ea2b6e1649b14486ca498cb9e6248541480e9e26f8f3660f2e91698cda3d43171c10fdd0e015134c034c291bf9f093ba40e20dc51d11d723b26e5ca89dae6770e2cad0ef33749587eae5b1f950571515dc0234e2c3a5e104f7c4d53cbd4c6f028a5125e122c329404c7eca792c0b088d7b6b60d3fcaedc801c2ab302f8284bf118eb0b77c1e289ba2cb8e13dc949497f5d4ec64e5d0ce15357df32b8d995ecb3d6bf31e0fa7b90a10c148e542c3187a5f551a303f5582bbdf8bc7502b99efb9ea2a6a92e6bc2e49791b1d4f5764728394b8450ca27e4c19b0d6535d03d3e7a2dc8a1dd3d460bed8d483e5c73ea93daa0996c68e347fe7c12eb11bb8c6b0fe6ff830ef1043dadcd68cc3cd80d7a8b38a6105790eabf5046773e16f54ecd2097c7e07055f091ffcbd951a6e288abd5e14b332a25dd520fcafead55829f46efcefea633901d10f521bbf0de543869e57f18335c77beccf3162392a29ebaac5f48d3dfb2bc69307cc7b01423636491ecba6bde16485d0b9ce03c2833fbf9278c419d1bd2be22f227ca45e23c571cbbf92e3a366a3f907bcfdcfd058c115ea0addbeb7fba44f2fc1f08a68abd19fe863887bd7b04fb11975f166d64228075a12b52fd31eeab4cbbb834c85a381301df02f8684f15b5e372f9a5531e8cbf4d7bff3f1ce1f92f9fd4e3ab7a38dd3f9592c892f5a0a491c6867f9900624b7cafbc419f11dd85da952c9965500f773cfd666fe4699feb4e944523a7cc8478ca8aa1b3e69fb0ef98d2d82eb157c66b0b2f6cc63c41c2458be7babd8ccfb400ad7a2169696fd55fefbb9e41eaff1d43c4e79d4fb86e74b693a4b0451115a59051507181542f682d4287865e8927c7c0896262478659dca1a04910a5a9db3aa43c582b225fdbd0f981a7db1756a2d8aeb0631a1a031fd0e58fad262e043ff3f6c956b1ee291954510d9ac2e96374ddca0328c9c3a8dbeae6e45989848aa5291e90885be907e1c484a4302667577435f41f85acac07c2e39dddc5f510af331a3310ad1dc326e17ec07e1ab1b7881add00d8883504019a3423ee8999b831c713de8e12f250b328d9cbc4e2dbb1df549a2b55e750ba4f3ed43602d909d1aaa834ca92d78c06df6d9d6870d774ee4e4ff7d2aaf22de194db4ee6645fde38828a7985160b8853ff39703101568f7981e13cbb34b0392ddf287f1d0d6f4d4df5e79e30e4ab191a60e614307cc38837e3e6ccc99ca98696cddc73c549f8deeada9e5b033a06545b2623c8e88f67be1a3deeee85849288e1bd13fe2a1c5ae6fd0c8778574a93b90a8792ff5572f689b23e12866dd41872b2357f75786a648a99ee489e08c588da03128066242a36476254d5c3b74ae5ee7e870730b9b78b02300d6e0404ffd1e7c496256f37d52e06b18c0504116d9ce55084bf7f803d5489b938e0c68957a6914e49b102537f995a656926ca105e00dfb2bc563d05f45c47fcdf70c86f2adaf88c79ca116dbb4174f11bb7b62777b080f30f4396fb2c764264f6a8efecc595238bbf7b96b5478b2feddc3f6e7ac126c9715d3187fbf72c2167d9c9fd2454d5d2778f56da6885733503972b2466dc83263d3bee977a5e1559ac2c67bb9de14ccf4ffaff237f8dd727cdd30c1a77807b2d4ec7e0d749d46ee2343578abaa08d76f5fd1f34ed64ee4e9383a9095874f29255c20185e45438903a8dd0306a3d33f8f2929e655cc39f4f05c113e43cb5aa767f93f4f83596638bd842dcec8e6b9248bf69d4305ca68c305722808b9c55eb7ac9692fd050a945c27b1e98765ed6b160d57daf9a56e958d83daf390dd35dcc9273bfda3ad07742bace67117b46531e0298258b3b9f85569127db5ef42a6940fbcc2e82aa455a484c5e923319cdc98f719177e60df08e13cca2056ba89df0e7ef25e9931292b792fdf871a25c294da802418f77a93991b8e5aab8f1c9a7540775156268b370ac27d1cee3d707298c241662ec43a3c90a8c30ca844ce0d76953aee190e21d1adae39f0c1420b33a01e1993a841ece2da72e1641b6e62ef1bb53c47f03f733cc3f27817618312096b48590ca96038fb22bc6a16208707b5d43fc99fdc022e7f5e95f76f4f62113291ba9e47689883f1eaf17fcaff2ef869eba1df0ef08dd0aaa7432805cd37240b6a208f8c5fefdd188502ca746603151405ac6bc9edaf3e17a6aa6c6bc72de6a55c9005fbbb2f58fc39875d4b82af5dc9edc70d73ccd9a8640d66ac7e0e46c8b02b2ef332334bcb6ca44f8cd0201e3cbfa963dfcc40e6d549005941eee9350cf85c430eb93ac9d35e0e4151316739b005f05ce761e9460a7602d6bbf8d3e15ad35e97865a002ae82eb86d7b521c8be0741d82fe617372b53eb0ed843160ca8cb5316fc701e24d59f9703011ad7e5bd96763a21c29675cf1d2f7c1bab0c193de92f4ebd2ae431e795b5f133e873ebeda258d685049d1a96cdf4d1915de534945c30668abb49e2d4fae253c9a798cf14e2a440022423bdab7f449ddef86b2485580cbc549f6f5386f551eb0982e798b28c9c0e59fd9f882eccd0355b700ee01fc7c1c20743ec16f0b18441f0db524c73cd489902f53f2dcfc17f99181cc6fc7e882361879940fdd57f0727eb6a37b7ff1973203495e06902086728de94283a25beff9fce339f68a5545db289e74316a5a9b0a32d83984271028ee941a26a7131201b2e31806a6de18275bcbe1e50b00f74a53f1dce575e271319f89c932aa5300805565f3699a37c9a523103148e8d260247902642974575e542a01288e380910f93ff825c31c2ab700bf307b2462befc8af04043733768027b46af51deb064a08ef108011e20553fa860da0c54f15858ea043b954e4b3f1c3cfe0993f5cb43fb8403c407f79fbcae0374d69e72f871c63b297f92ccf7370f201021c776b28a1928f6069fce3b11e962d03bf588e1d5d60e991d20104d18c9566e7813e80681637f6b71ecc43e5c8ec20792322a1510afae7e1b5108b8fe6a55629c87d93f11a05701f0bcfd9f1793f32059170b6adec8f2459e650040f4693921a9ca6d83f43ebe8903881fa1d1732437f74bcab6a4d0a8b418597ac7736dde408e190a531431c56bc515d402eab4501a637033cfecffc82d034bca9556f39b28972882cdc4fb64094dffb43c05355af0f76b90a3968b84c815b6232448c8e9a903a3e4ccaf05e777f90a8328f61f63572b46be584cac76a4c090453dde81a0dcab9d274d9cd671283e66378123ea2ed77e4d446e32c2cf2cc177f467fe504a3a7b83246737b737c1915054a7208cadaa5700dbc403a7f6a051f5c0fdfa5361555138c0826e24445e97372b51ea78f529b4e338f7071bc1858a2a91e58db56d4b0623bb506d98783abb7ff04746cab2a868bc46f1eeb2e3beae1eff3f740701b898db7f2e2414046c8709ba7dd14d29273fda922de7b593ad578e9d835ebd7be61f0508c7bbf90780b0b1580edf44cacdff2ef16c80b1989bc9f5ce96ee17d19d618541d3597e5d71443bc9e2e7535e4bf1622053742a4e64774ce1d2f56b5a53fd99ddff9513296ede4583e78a5c8fc7983f0e6b75c006047e83e0e744f2be1e18b5e2098255dcff2fcaf9c4bf56faca6ae914f6b0fd08f7e20cfc6a3bb0629c6b18419f1462a54666820b1058f85a8eb41c79d0375fa8a19faa1be1ae266d799f298fa59e440d81ebbe24e45c02c960fbfed610344e70c216195d327d2b69131b7dd81d004604c49edad4cece00885de86ee86d15fe58db18cf4367e612b577d5a688c831bf04f33f2e9e9ea66c4e8de6798cb346c45ef8b5b29334f796cb13c86993abe697e76eff4ec0042ea12483245f1307286d8235a85a0e3a78bd6327d79bb81231d6bec6af927a7dcee853feb4821dac2bd2c52deeeecb8256377ffd56101b66b545c1a41935503d0de36c6a89fc2173b37315b5e3956e8b6dfe6efb3ff3be94ab8246d2f304cbc0f93483d626904b707a174dc0e0af3c5355454196863435a366920124f6c878b782ea7470c3f4b6ae9f6a9ebbc9942be24204dcaee2b43c26894c5b5daa703a3914ccc6f31016762b64e755dcaf3d3f582220540285237bc0049f4745e711c5fe81306cd8c96c2b55e4b00556d3dd8e6a9cc6c82ff0be9e0fd09462748739c7d3ed759d095ac0d020c4eba11c5d88f9dd745005e996f23210a2a86b544655643bec5c54f997824701a94b591b759e865635039bcb6abf9bc57061978f77e65002a9ee76ac2fcfc4a55c2df78ae9500d23523b75ab335cb9c06f876025f61793b6a0f6686b212a102ffb46f3b6d7f816444e393f9cb16ca550d2cc14262465e7f793a1a1a59f0008cc330caee28dbbcac2b1f29b1613667ddf1498967f66302147d7a42baa6232095f8c29c69f7936c4839bca715e14af5d153ce452c74e41c16cfb7eff35692223f58ae13a79b67b06717dbf334d2851863a2ee224118283f08d42b896bd5751a57de9d511877a6475ebb29ff109977ad87356e471aa2b82d91feab6f900b204a9fd4b4376972ea83ec5ad0c665e4e38a69fb0a10a5fc8eb59be59cd69d7bb9d0c3a31d72940ce3380730083655131c7d06dc66bc2f1b3eca0ea43e0fba86a4dec1b0a87f0aa754703ec05d26207698c997b1515b4bbc48a72ea8a3b1228ee315577c9b2fd08170936e52303492650f4332766863187e63d906df89dc423b7c60b5fd6a9257ddfed12249354724b366056d545d17b415d5cbcea4c65a949e7127496529ddf25cbd1aa492a68e8b70abc2e9fdab168f351c6413cdf06e44e51c2727b4248e43e7e726dfe153edee7b19e5a87581820ec9d168a972a9a96fb94dc6993f71fb3f502bd2ae93d659bca41bf9658d41e42e918702f84a68cdf56edf231b6038762643d3de0d515a2ba6edd2840bab9e7a249ec19b27088cead03532c1ec130e5f4afd1fc7ffa20c4a69c11ccea2754e9fbfdfea42f3cb1e037c3a09853cf8e51a16e6b0b3c1618e2084ddacb01dc800471b80b1b34be23384319d73dad0c63d467eabfd5469490db6c989d920fc8fb1a0dfd4ef62936d1578e0d8f4e028ace8bce835f48a6895ab72f29de31f8e5296c04db7ff303a502870297c38c2e09de7176d2bb740de37aee3627e3db32b0c86a5420e80eea8036055c8e91538d28cf77419307ce10623e5812430e5f616776b383d529fe7f95962c3155a296d8ac951cf814d6325080d540c053e04a237d90443b4f1a9b3752ffe2b6a9fb37b1d96dce9086c048e51a7a045fdd92a7e894e3487673e2be1c0522b89ebd2c69fa01833cbcfcddfd1d2a950dcdd7a4fc5b500432f98f1bff46f3bead268a1798c21d7410e803680ebc096f295c062de0612f71107532ae833f1861074cbd5937ccac425ac5e2a46a1e34e8f19ecc2b98aec56ec6fc20b6965559859b6b07ba7777f5cc1ea2a347813720e5ba0b202a3f99ae1e3e96540c4fbba07dd822b808495f4cbf94d8424e16ec1dfe4b627f5414a913e0e2865cc83485f29603f8407765922a81e4b95979588770d032dfd0996c4fdde639f4c72a1132f4ac2d4c780152c8f496389add7f4a9bb0e6c6844f67b2c243b965a389e9cf27f9ecbe7851f9dac39376d5a2c27edba16f18e635cf8bdf9edfc956ddb49b59eb0d21cf908a9bcaf11ac8a0d745ccd3c024de82c01a4da02c5e6f08fbbd412394968925dd25463192b0af569eb2f17b4d18ce4aed7a744ef9d6a4a5e8c0e64bfd8aa4c472329c7f2e144a4374e933ef9a6c8ecfb36df2be54502cbe120a6668098674e058d2d32940f15c0cbb6102e80c2e66f250c9274e1f5416011e669e8360f0901738b9b96cd7cbb1311283a40642c51718f1fe99cc08bafee4312e20df5eea8ceed46859c10f99947071370b56bf66d876dafb68a70d330c6ac0c4401a8cd92f329b905cce3de6bc6e03a59115501c6f66fd3653435dbbbd2061df09d808ff3b55461dcb3e1f625151a3fa7b2330302442ab660ca012ad2cbc5219567b2ddfb05af88298a43a2fd6dfeed7337d4b30642ff2886c050232679989b44f69b7ec962fbf29fb1e5e0b1674f8b64dd7bea2663f2a77b2332576114fcd0f0514c95c77cc0fd76e27ffeba72e166892b2298f45bb128a666116cf44cae3ce5e7023a0e52631f396a63e14fd2b47c6f7a061a87b162a781a26e4ea753a33091d63b81bce7a0b701246786a215a0fa533fd04b7501cd04424744a0c505cb8c13e67e76fac7b17caced517b464794a0454eda7ec789025b8ce9bc3211ddd280bc7213034aa201eaac1c7cf26380893d35da71896d2a1fade91377c5caab84187fefb04a6d0ea6a3565344f8ee475962a03234f92ff2405f7833719d134682769325b44b1ad346dc0842056cc53a2848fccd3c53d811e4749404a4708041b3a51b36dc47d8be544faf17be4f64338a309411b3136de5cd937719c18670e986252b07444138f5464de15a931ab253b968a12db0a971e028d80fbfa4d148404f55f286a67813099df9558fe10f6befdaa85d0e56025df64a080d722c808803e09ee475a85cbfba80de36bd863dd11019b138eb4ce594196725622899758d19501725cf8dfecdd07c2070f73fa87cab88d8e07d02d16b1def4bc2c85310b6146620f8bfd304d4b5a9b827324c62d914e52ade3e2c87e8e259f49af266fcaa8aadcbf2ff8a3be1561b85109586a56025da9fc0836d9038abd59d66dcdc4d04e039b63eb1c322b649170c14ca080d95c175855e9b93aa5edadebdecd47e6b0a0c0e38568d2084f3c96837aadac12d8066ef45ce7dc7ec0f6d0777c33a6155cb63ce194ff13c0d5a63340daacfa007dc8286746bc95140641d3594b76e8fceced984338f3946a0066e04c89d06c51f33a5ce0b5bab7d8b3939e0eb408a595c2669e82f010a1f0839328a7b0d6ceff20db51f1beddf271a37149af2f2919b61b644d9ef82db6f51b3d8dedc4996ad4d5f0ae9d06f7b136ed084a3c6ee12b157cdbc3fdba52b592a0974cca59b6085fc2e78e053bb3c585d038f42ea26cd79fe6d72823b4cad0dcede5e955a1ab1bcd800e6a7b1be6a4e94858f5df2bad2d6eb11d3cef263c67cb864ea9d01def7896953efed996e03b3e9c53df8e0d05e92b6605eedfb95aa730108ed42500e63f4fb8c46447f3aef48f0f42a79913805ddd851cc1f121a6eb480e81a24584e4357c5033627c34891bff0bf0552fb476ef4de2e63817f50984a6eb820ceb278663fa2018fdfa99a2f5767a341eb1619984bd66d1c6fc7ef8f101b6a547d1df91940186c28d0caf6f6963a40c6eca185327f5c7c0e99de7ff6ad4fadc84c0e1a4838d1f07c03bfeec789da1d1438666b7f8bb7f2653c333c298900267a86944f9963c884d5d207d7e4aa2cfddb327c332ef9e861153cf3841d076f7185f933cbc9a5e98c88f0f28b37233f096096c8143834823b4e9e400fd1f3beb193abf50acba409dac313a4490571ab97c1ee30aed8d319eb15fd5f17c3477e3e58ac943ade43a311e5631f64b6a2b165a6bd260f31bf32012c6dae1d7d89efcf5e3850820d493250639977e29570d6ae08fa3dea0efc8fef7047ab899e65feccf8a0113694ea416f6d19634222074995083221f5c7692930e39a3fedc983227f867fbde82899ba8a6d38c4760cdc4c7c1c2f6777c2d5c2d7c408730c110df8ac9966c5acaaa88735b454c4beddcca8d1fb366384062bca7bba71d79739c06262b976d64bc8616c6f0afde3b81536ccf39a8b3a2b90e6885c1361a398561148dfc1e724eff6b9a02d141fc42f3feb8a70903260207bf8183c248e55be66db6cb647f06855eb8029981fe173b8c9ce69a59cef1c5792cc500116824756a592e6b20c73bb9e5759283415d94bc55e6f0e47bd8d782a3e2c63585b47ffb01bfcc97ee5d60e20983a6677d375e0227f5148beaaad864353f0d1b79c020edfbc9fe666a7d4fdd8bf47582b9715e3b65b2bedfcb5012d69c44351f19325d736a33725bd0d35de3f94aa601a022ef564e40a4e528c5024eac3988afdcc5c44360d03dcdea49ed9baac342df7d9ba1e159dc425aa08bd5574d42e1f8502fd23fda4e77a86210d9ff7caf2a7e16c182ae77c11e4b401d6039bb03ac0f5f786771233165cd0fa220ee1ef5720227fec9b7342576d6916f78d5f4c0759006f83899ff5669c916c72d4b325927a9fde7caa739c755464ec4f1c2ed5b90e1f45ec1ae111a28d52555c2fd3d95ffc5394456eb445c66e00bf783437fe6789f45de39c42fb94520af07064b59099db6761649f3fbc5320411733c92928ded139ea967b119646b89886e2f0065dfe13f2c4fba21a1111dda6bbb4acff602573ff1aeb7e382aaafe65a6951546f7eaf33cec5215ea8587031eb315a23be586e07d098a30a8ce9a08be848194a445299a952e5421ee5a7df2f9a3a4567596c14f72214612c50dc8a5ae1cf2acd4c9d7e6d172bc8fe186609dbb654a767c5a14bd24480677314641214a096c37354586a69e77a28fa4ec6aa0df7c2e6b90f2f0de11609081b39dd9cac5375910bf038089f41713e4cc984bd1d4a3ebe9f84eb636627f90452c89fab45978eb5565271333bd435f1b71bfe1a4d2bb7a4c08075ee5777a3ccb4a0cd731cf27d6711c476749ff32dbfc314189fee58f8b21b507e5b56ae8a4902e18abbd0583e931bd1fef1f1bdcf5d591e42cfa6fb20cb8e1416867afcf6328e8a00a3c9e84326748941d54a058dcaa1556d163e293b2f623c03809d6ad687b42ca290e128633650fcc185019719c2966fcaf2be346d345f2947ba76af8aa3777ccb84190585561b99e1b23b0e1d89abcc0dd5e92146d23e65cb9822065eed9a8c4d65c0ab539429c08b81f18d5ecee69390184d772253a685489438c2559aa5794971d559ce559d8f1f1f36788c999628697dadb36995d58c52143a29388ec01f9a6412d96791aad7c322671f3702efb07a308cfa86f2b724ef521859bbf78fdbb37b04f2017cb627d082e274796bd756008e5ffc0f180d4f4b031e9e6494d7f715910067e0e06944e0be38d628f3bfe4d84b8dda5cf1b25e89b3381c87d9fe8c8e91934789fc952088a5e7860c5a7c5a21d133501b2a2a11e6ec8e8fc47daf238991e322e59426976b556a9e8f7c5c2a2ef7857718ef7bd63964de64a1cf146c32f17f723d0ee482c3619c4fa381edb67325ce2977e1a893cbcce62ac39ec6c8d3d903fb6c38ab49258d95fd317b1'java_raw_res = '2c5fc8a643ef334889238c26a41b360daa0156f71b0cca70b8bee7612de7fe4e'data = decrypter.decrypt_req_payload(bytes(bytearray.fromhex(java_raw_req)))print(data)# data = decrypter.decrypt_res_payload(bytes(bytearray.fromhex(java_raw_res)))# print(data)f1=open('java_AES_Decode.txt','wb')f1.write(data)

同理，也可以用Cyberchef

将解密后的文本放到010编辑器

把PDF头部之前的内容删掉，保存成pdf

打开得到flag

flag{dD7g_jk90_jnVm_aPkcs}